Amendment in Response to Office Action of January 8, 2009 
Application No. 10/781,913 
Attorney Docket 2500.0002C (INP0005-US) 

REMARKS 

Claims 1-16 remain pending in this application. Claims 1, 8 and 12 have been amended 
hereby. Support for the amendments to the claims can be found throughout the specification, 
and in particular, Table 2 of paragraph [0021] thereof. No new matter has been presented. For 
the reasons stated below. Applicants respectfully submit that all claims pending in this 
application are in condition for allowance. 

In the Office Action mailed January 8, 2009, claims 1-16 were rejected under 35 U.S.C. 
§103(a) as being unpatentable over Allison et al. (WO 200271234 A) ("Allison") in view of 
Gould et al. (U.S. 2004/0199592 Al) ("Gould") and further in view of Mazur (U.S. 7,424,209) 
("Mazur"). This ground of rejection is respectfully traversed. 

Applicants note the comment of the Examiner on page 9 of the Office Action indicating 
that amendments to the claims with respect to some of the disclosed subject matter may be 
helpful in overcoming the present grounds of rejection. Applicants appreciate the Examiner's 
efforts to further the prosecution of this case. To that end. Applicants have now further amended 
the claims to make clear that multiple (i.e., more than two) entries in a timestamp aiiay aie 
provided for given ones of sources or source addresses. Support for the amendment can be 
found in the portion of the specification identified by the ExEiminer in his comment on page 9 of 
the Office Action. Applicants respectfully submit that none of the cited prior art references 
(even the newly-cited Mazur reference) discloses or suggests the claimed invention. 

More specifically, the claims of the present application require that the timestamp array 
that is filled as source address counters are incremented include multiple entries for each source 
address (" wherein the array of timestamps includes more than two timestamps for a given source 
address"). As expMned previously, Gould does not disclose storing multiple timestamps for 
given source addresses, but rather discloses storing at most two source addresses (not "more than 
two"). 

Gould describes two (and just two) timestamps: 

1. In the case of the first sighting of a new originating IP address 
(in a first message) a first time stamp. The first timestamp is 
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preserved in a new IP address record when that new IP address 
record is created and the record's message counter is set to 1. 
2. In the case of a subsequent sighting of an originating IP address 
(in an nth message) an nth timestamp. The nth timestamp is not 
preserved in the record, but the message counter (in the 
associated IP address record) is incremented. 
Thus, the referenced portions of Gould (specifically Figure 2, Figure 4, 110037, and 1(0045 
K0047) describe a model that preserves (for each address) just a single timestamp (or at most 
two), as shown below: 



I IP Address | Counter | Timestamp | 

+ + + + 

I 208.77.188.166 | 3 | 03/31/2009 08:47:24 | 

While the first timestamp is saved (in an IP address record) all of the subsequent 
timestamps (from all of the subsequent messages) up to an nth timestamp (from an nth message) 
- 2, 3, 4, . . ., n-3, n-2, n-1 - are not stored or preserved. And at the point that an n+lth message 
is received (and thus an n+lth timestzimp is avdlable) the nth timestzimp would be lost. 

Gould's e-mail governor may then subtract an nth timestamp (which could be considered 
a second stored timestamp) from a first timestamp (since the first timestamp was presei-ved in an 
IP address record) to ascertain gross elapsed time. However, since all of the intervening 
timestamps (from all of the intervening messages) are lost under Gould's model there would 
never be an occasion in which "more than two" timestamps would be included in the array, as is 
expressly required by the cMms. 

The Office Action now further relies on Mzizur for the claimed limitation having to do 
with "iterating through the array of timestzimps to access all source counters and associated 
timestamps." 
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Mazur discloses a method for real-time data archival. A synchronizer is employed to 
facilitate the generation of real-time timestamps from a plurality of reference timestamps 
associated with a digital video stream, such as MPEG-2, for subsequent playback. Firstly, 
MPEG-2 reference timestamps (even transformed into real-time timestamps) have nothing at all 
to do with the time at which a message is received over a network. Thus, while Mazur might 
take advantage of an aiTay of timestamps, such an array of timestzimps is entirely different from 
the context of the present invention. 

In any event, Gould does not disclose an array of timestamps with more than two entries 
for a given source, £ind thus one skilled in the art would never, in the first place, have been 
inclined to look to the teachings of large timestamp arrays as contemplated by Mazur. Thus, it is 
respectfully submitted that one of ordinary skill in the art, would not have found the teachings of 
Mazur at all relevant to the teachings of Gould, since Gould is clearly limited to storing only a 
single earlier timestamp, which is subtracted from a single later timestamp (which later 
timestamp may never even be stored along with the earlier timestamp). That is, there is never 
any use in Gould for an array of timestampS as is now even more clearly recited in the claims. 

In sum, the Gould model is very different from the claimed invention wherein an array of 
timest£imps is preserved for each source address, as shown below: 

+ + + + 

I Address | Counter | Timestamps | 

I 703-555-1212 | 3 | 03/31/2009 08:47:24 | 
I I I 03/31/2009 09:03:39 | 
I I I 03/31/2009 09:18:04 | 
+ + + + 

and Mazur does nothing to cure the deficiencies of Gould. 

Furthermore, the cMms of the present application expressly require "removing entries in 
the array of timestamps that are older than a fixed window size , and decrementing the source 
counter for each entry so removed ." None of the prior art discloses anything like these claimed 
limitations. More specifically, Gould is silent regarding removing or deleting entries from the 
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described "IP address record," or decrementing a counter as a result of any such operation. Since 
Gould does not describe removal or deletion of entries, it is not possible that Gould teaches the 
specific methodology of removing entries based on a "fixed window size," or decrementing a 
counter as a result thereof, as is required by the claims. 

In view of the forgoing, all of the claims in this case are believed to be in condition for 
allowance. Should the Examiner have any questions or determine that any further action is 
desirable to place this application in even better condition for issue, the Examiner is encouraged 
to telephone appliczints' undersigned representative at the number listed below. 



Dated: April 7, 2009 Respectfully submitted by: 

Edell, Shapiro & Finnan, LLC /Lawrence D. Eisen/ 

Customer No. 27896 Lawrence D. Eisen 

1901 Research Boulevard, Suite 400 Reg. No. 41009 
Rockville, MD 20850 
(301) 424-3640 
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